I'm Confused from the fact that Vlan tagging is done at access port and trunk port always gets tagged packets (until its case of native vlan).But I still believe in other fact which says tagging happen only when a frame hit the trunk port which means trunk port gets untagged frame and tagging is not possible at access port.

Would like to know where actually this tagging happens ?

and also which command we can use to encapsulate 802.1q protocol to access port ?
The way we do at trunk port is

2 Answers
2

Vlan Tags are only pushed on the packet if it comes in untagged and egresses a trunk port; otherwise, the packet's vlan is simply tracked internally in the switch. Packets ingress to an access vlan port are tagged with that same vlan on the trunk port. The only exception is a packet that is on the trunk port's native vlan (default, vlan 1 on Cisco switches)

Mike Pennington thanks for your response ,very simple behavior would like to ask ,when a packets from end station hits switch's access port ,will it be tagged or only when frame hit the trunk will be tagged.This is behavior wanted to confirm on. Can access port do the valn tagging ?
–
PathaSep 28 '12 at 9:27

the behavior you described in your comment is correct. Packets ingress to an access port are tagged on the trunk port. The only exception is a packet that is on the trunk port's native vlan (default, vlan 1 on Cisco switches)
–
Mike PenningtonSep 28 '12 at 9:42

1

A vlan is a logical construct internal to a switch. The access port receives the frame, and the switch is aware of what vlan that access port belongs to via configuration. Tagging only happens between switches on Trunk links as Mike stated so the switches can communicate vlan context to each other.
–
Niall ByrneSep 28 '12 at 9:46

is needed (on some) cisco switches to explicitly set the trunking mode as there are switches where ISL trunking is also available.
On other (mostly smaller desktop) switches it produces an error (because dot1q is the only trunking mode there).